A network address blacklist represents a collection of source Internet Protocol (IP) addresses that have been deemed undesirable, where typically these addresses have been involved in previous illicit activities (e.g., network attacks). One way to generate network address blacklists is to regularly solicit security log entries from voluntary contributors distributed across the Internet and to compile and post firewall-parsable blacklists of the most prolific attack sources seen by these contributors. A smaller-scale solution creates local blacklists based entirely on an individual network's history of incoming communications.
Although both approaches are relatively effective in defending a network against known attack sources, neither provides the capability to include an attack source's address before the attack source has saturated the network. Thus, a prolific attack source may cause serious damage before it can be identified and included in a network blacklist.
Thus, there is a need in the art for a method and apparatus for generating highly predictive blacklists.